CVE-2024-28142 is a cross-site scripting (XSS) vulnerability in the "File Name" page (/cgi/uset.cgi?-cfilename) of the User Settings menu. The vulnerability arises from missing input sanitization of the file name and wildcard character input fields, allowing attackers to inject arbitrary JavaScript code. This malicious code executes when the page is viewed, potentially by higher privileged users such as administrators. Notably, the attack can be performed without authentication, as the affected functions are not fully protected, allowing modification of the file name parameter for the "Default" user.